Windows 11 Version 23H2 Reaches End of Support for Enterprise and Education With the Final KB5131087 Update

Microsoft has ended support for Windows 11 version 23H2 on Enterprise and Education editions. The November 2026 security update, KB5131087, is the last update these editions will receive, according to Microsoft's release notes. Devices that stay on version 23H2 will no longer get monthly security fixes.

Version 23H2 first shipped in October 2023. Home and Pro editions reached the end of support last year, after the usual two years, while Enterprise and Education editions get 36 months of updates.

What the Final Windows 11 23H2 Update Includes

KB5131087 is a cumulative update that rolls in the October security update and an October out of band fix. Microsoft lists these changes:

• security fixes for vulnerabilities patched this month
• a fix for adding printers published in Active Directory, which could fail with error 87 after the October update
• NTLM message signing offered by default for non anonymous connections, to reduce exposure to NTLM relay attacks
• a fix for a Remote Desktop trusted publisher policy that could not be set through Intune
• more devices targeted for the new Secure Boot certificates, which replace certificates that began expiring in 2026
• updated daylight saving time rules for Cuba

Microsoft notes that the Secure Boot certificate rollout continues through Windows Update for eligible devices. That process does not change the end of support date for version 23H2.

How to Stay Supported on Windows 11

Microsoft recommends moving eligible devices to a supported version of Windows 11. Versions 24H2, 25H2, and 26H1 currently receive feature and security updates, and version 26H2 is in the Release Preview channel ahead of a general rollout.

Home and Pro users should already have been offered an upgrade. Enterprise and Education devices may need action from IT if they have not been moved yet:

1. Install KB5131087 so the device has the final 23H2 security fixes.
2. Check the version under Settings > System > About.
3. Upgrade to version 24H2 or later through Windows Update, WSUS, or the organization's management tools.

Microsoft supports each Windows 11 version for two years on Home and Pro and three years on Enterprise and Education. Version 24H2 therefore has one more year of support on Home and Pro and two more years on commercial editions. LTSC and IoT editions follow their own, longer lifecycle and are not affected by this change.

Organizations that skip the upgrade can keep using version 23H2, but the devices will be exposed to any vulnerability patched after November 2026. Schools and companies that still run 23H2 on a large number of machines should plan the move to a newer version as soon as possible.

Microsoft has not announced any paid extended security updates for Windows 11 version 23H2, unlike the program it offers for Windows 10.